Live › vulnerability › CVE-2026-111889
Go to dashboardphpMyFAQ versions 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta are missing an authorization check on the admin dashboard. Any activated account without admin rights can read unpublished FAQ questions, admin edit URLs, recent user identities and site statistics.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running phpMyFAQ 4.1.x before 4.1.9 or 4.2.0-alpha builds, where any user with an activated account can sign in. Sites that allow only admins to register accounts, or that run a patched release, are not exposed to this flaw.
No product ranges from the sources yet.
phpmyfaq version info in the admin area or the package manifest; affected range is 4.1.0 to below 4.1.9, and 4.2.0-alpha to below 4.2.0-beta./admin/index.php/ as a non-admin logged-in user and see whether dashboard data is returned.4.1.9 or later on the 4.1 line, or to 4.2.0-beta or later on the 4.2 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read unpublished FAQ questions, admin edit URLs, recent user identities, and site statistics.
This page as .md · .json · in your agent: get_signal("CVE-2026-111889")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.